[MINOR] fix(auth): Handle missing parent catalog during metadata id resolution

[jarredhj0214]

What changes were proposed in this pull request?

This PR updates MetadataIdConverter to gracefully handle missing parent metadata during metadata id resolution.

When resolving metadata ids for objects such as filesets, schemas, tables, or topics, MetadataIdConverter normalizes the object identifier according to the parent catalog's case-sensitivity capability before looking up the entity id. If that parent catalog no longer exists, the target metadata cannot be resolved, so the converter now returns Optional.empty() instead of propagating NotFoundException.

A unit test was added to cover the missing parent catalog case.

Why are the changes needed?

Revoking privileges from a role for a metadata object whose parent catalog no longer exists can fail during authorization expression evaluation with an internal error.

For example, the failure can look like:

System internal error during authorization - Operation: revokePrivilegeFromRole
Caused by: org.apache.gravitino.exceptions.NoSuchCatalogException:
Catalog <metalake>.<catalog> does not exist
  at org.apache.gravitino.catalog.CatalogManager.loadCatalogInternal
  at org.apache.gravitino.catalog.CapabilityHelpers.getCapability
  at org.apache.gravitino.server.authorization.MetadataIdConverter.normalizeCaseSensitive
  at org.apache.gravitino.server.authorization.MetadataIdConverter.getID
  at org.apache.gravitino.server.authorization.jcasbin.JcasbinAuthorizationLookups.loadMetadataId

This happens before the revoke operation reaches the business logic. During authorization, the requested metadata object is converted to an internal metadata id. For child metadata objects, this conversion first loads the parent catalog to apply the correct case-sensitivity normalization. If the parent catalog has already been dropped, that lookup throws NoSuchCatalogException, which currently bubbles up through the authorization expression evaluator as an internal error.

Returning Optional.empty() is consistent with the existing contract of MetadataIdConverter#getID: if the metadata object cannot be resolved, the converter should return empty. A missing parent catalog means the requested child metadata object cannot exist or be resolved in Gravitino, so treating it as missing metadata is safer and more accurate than failing authorization evaluation with an internal exception.

Fix: #12216

Does this PR introduce any user-facing change?

No API or configuration changes.

How was this patch tested?

Ran:

./gradlew :server-common:test \
  --tests org.apache.gravitino.server.authorization.TestMetadataIdConverter \
  --tests org.apache.gravitino.server.authorization.jcasbin.TestJcasbinAuthorizationLookups \
  -PskipITs -PskipDockerTests=false

[roryqi]

Could u create an issue first? The fix type pull request should have an issue to track the fixed version.

[jarredhj0214]

Could u create an issue first? The fix type pull request should have an issue to track the fixed version.

ok

[github-actions]

Code Coverage Report

Overall Project	67.96%	🟢
Files changed	68.75%	🟢

Module	Coverage
aliyun	1.72%	🔴
api	48.1% -0.03%	🟢
authorization-common	85.96%	🟢
aws	42.04%	🟢
azure	2.47%	🔴
catalog-common	9.92%	🔴
catalog-fileset	79.74%	🟢
catalog-glue	66.91%	🟢
catalog-hive	79.4%	🟢
catalog-jdbc-common	45.7%	🟢
catalog-jdbc-doris	81.8%	🟢
catalog-jdbc-mysql	79.33%	🟢
catalog-jdbc-postgresql	83.39%	🟢
catalog-jdbc-starrocks	79.16%	🟢
catalog-kafka	77.01%	🟢
catalog-lakehouse-generic	59.18%	🟢
catalog-lakehouse-hudi	79.1%	🟢
catalog-lakehouse-iceberg	85.86%	🟢
catalog-lakehouse-paimon	84.23%	🟢
catalog-model	77.72%	🟢
cli	44.5%	🟢
client-java	78.27%	🟢
common	52.07%	🟢
core	82.85%	🟢
filesystem-hadoop3	77.28%	🟢
flink	0.0%	🔴
flink-common	48.65%	🟢
flink-runtime	0.0%	🔴
gcp	14.12%	🔴
hadoop-auth	68.0%	🟢
hadoop-common	12.7%	🔴
hive-metastore-common	53.4%	🟢
iceberg-common	64.65%	🟢
iceberg-rest-server	75.02%	🟢
idp-basic	86.02%	🟢
integration-test-common	0.0%	🔴
jobs	66.17%	🟢
lance-common	20.67%	🔴
lance-rest-server	64.23%	🟢
lineage	53.02%	🟢
optimizer	83.24%	🟢
optimizer-api	21.95%	🔴
server	86.02%	🟢
server-common	76.34% -0.01%	🟢
spark	28.57%	🔴
spark-common	46.01%	🟢
tencent	69.84%	🟢
trino-connector	40.29%	🟢

Files

Module	File	Coverage
api	SupportsTags.java	0.0%	🔴
	Tag.java	0.0%	🔴
	TagOperations.java	0.0%	🔴
server-common	MetadataIdConverter.java	75.86%	🟢